[Bug c/17468] New: Java garbage collector miscompiled at -O1 and higher

[Bug c/17468] New: Java garbage collector miscompiled at -O1 and higher

[Hans dot Boehm at hp dot com]

The (ancient) GC_descr_obj_sz() function in boehm-gc/typd_mlc.c is miscompiled 
by gcc4.0 20040913.  This was also true for the version from two weeks before 
that.  This usually causes "make check" in boehm-gc to fail.  However this 
function is not normally used by the gcj runtime.

I distilled this down to the self-contained example which is appended.  Some 
quick attempts to simplify this further by removing switch cases failed.

It is fairly easy to trace through the assembly code for the LEAF_TAG (=1) 
case, and see that there is a problem.  For example, the multiplication never 
happens.

I haven't had a chence to check this on other platforms.  It may be a generic 
issue.

-fno-strict-alias has no effect, and I don't see how it could.

Hans

/* Array descriptors.  GC_array_mark_proc understands these.	*/
/* We may eventually need to add provisions for headers and	*/
/* trailers.  Hence we provide for tree structured descriptors, */
/* though we don't really use them currently.			*/
typedef union ComplexDescriptor {
    struct LeafDescriptor {	/* Describes simple array	*/
        unsigned long ld_tag;
#	define LEAF_TAG 1
	unsigned long ld_size;		/* bytes per element	*/
				/* multiple of ALIGNMENT	*/
	unsigned long ld_nelements;	/* Number of elements.	*/
	unsigned long ld_descriptor; /* A simple length, bitmap,	*/
				/* or procedure descriptor.	*/
    } ld;
    struct ComplexArrayDescriptor {
        unsigned long ad_tag;
#	define ARRAY_TAG 2
	unsigned long ad_nelements;
	union ComplexDescriptor * ad_element_descr;
    } ad;
    struct SequenceDescriptor {
        unsigned long sd_tag;
#	define SEQUENCE_TAG 3
	union ComplexDescriptor * sd_first;
	union ComplexDescriptor * sd_second;
    } sd;
} complex_descriptor;
#define TAG ld.ld_tag

/* Return the size of the object described by d.  It would be faster to	*/
/* store this directly, or to compute it as part of			*/
/* GC_push_complex_descriptor, but hopefully it doesn't matter.		*/
unsigned long GC_descr_obj_size(d)
register complex_descriptor *d;
{
    switch(d -> TAG) {
      case LEAF_TAG:
      	return(d -> ld.ld_nelements * d -> ld.ld_size);
      case ARRAY_TAG:
        return(d -> ad.ad_nelements
               * GC_descr_obj_size(d -> ad.ad_element_descr));
      case SEQUENCE_TAG:
        return(GC_descr_obj_size(d -> sd.sd_first)
               + GC_descr_obj_size(d -> sd.sd_second));
      default:
        return 17;
        /*NOTREACHED*/ return 0; /*NOTREACHED*/
    }
}

int main()
{
   complex_descriptor d;

   d.ld.ld_tag = 1;
   d.ld.ld_size = 2;
   d.ld.ld_nelements = 3;
   if (GC_descr_obj_size(&d) != 6) write(2, "wrong answer\n", 13);
   return 0;
}

-- 
           Summary: Java garbage collector miscompiled at -O1 and higher
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: Hans dot Boehm at hp dot com
                CC: gcc-bugs at gcc dot gnu dot org,rth at redhat dot com
 GCC build triplet: ia64-unknown-linux
  GCC host triplet: ia64-unknown-linux
GCC target triplet: ia64-unknown-linux


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug c/17468] Java garbage collector miscompiled at -O1 and higher [4.0 regression]

[Hans dot Boehm at hp dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
            Summary|Java garbage collector      |Java garbage collector
                   |miscompiled at -O1 and      |miscompiled at -O1 and
                   |higher                      |higher [4.0 regression]


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |critical
          Component|c                           |tree-optimization
            Summary|Java garbage collector      |[4.0 regression] Java
                   |miscompiled at -O1 and      |garbage collector
                   |higher [4.0 regression]     |miscompiled at -O1 and
                   |                            |higher
   Target Milestone|---                         |4.0.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[mckinlay at redhat dot com]

------- Additional Comments From mckinlay at redhat dot com  2004-09-13 22:15 -------
I can confirm that its a generic bug. The test case also fails on i386 and
x86_64. It fails at -O1/-O2, but not at -O3. It appears to be a problem with
tree-tailcall.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2004-09-13 22:15:34
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-09-14 06:54 -------
Lets look into the flow a little of .optimized:
<L6>:;
  mult_acc.12 = 1;
  add_acc.13 = 0;
  goto <bb 2> (<L7>);
...
<L7>:;
  switch (d->ld.ld_tag)
    {
      case 1: goto <L0>;
...

<L0>:;
  T.1 = d->ld.ld_nelements * d->ld.ld_size;
  goto <bb 6> (<L4>);
...

<L4>:;
  acc_tmp.16 = acc_tmp.15 + add_acc.13;
  acc_tmp.15 = T.1 * mult_acc.12;
  return acc_tmp.16;

hmm, where is acc_tmp.15 set, except in that last BB?

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2004-09-14 07:20 -------
>From the .26.tailc dump, it's obvious that the two stmts are just reversed.

  <retval>_4 = D.1138_1;
  acc_tmp.5_29 = add_acc.2_23 + acc_tmp.4_28;
  acc_tmp.4_28 = mult_acc.1_22 * <retval>_4;
  return acc_tmp.5_29;

But there's a second more subtle bug in that we should be generating

  acc_tmp.4_28 = mult_acc.1_22 * D.1138_1;
  acc_tmp.5_29 = add_acc.2_23 + acc_tmp.4_28;
  <retval>_4 = acc_tmp.5_29
  return <retval>_4;

The trick here is that <retval> will have DECL_RTL as a hard register.
We cannot legitimately extend its lifetime at all.  This is not normally
a problem, given how we generate trees.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[rakdver at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |rakdver at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-09-14 21:08 -------
http://gcc.gnu.org/ml/gcc-patches/2004-09/msg01478.html

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-09-15 07:51 -------
Subject: Bug 17468

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	rakdver@gcc.gnu.org	2004-09-15 07:51:33

Modified files:
	gcc            : ChangeLog tree-ssa.c tree-tailcall.c 

Log message:
	PR tree-optimization/17468
	* tree-ssa.c (verify_use, verify_phi_args, verify_ssa):  Verify that
	definition inside a block precede uses.
	* tree-tailcall.c (adjust_return_value): Emit statements in the
	correct order.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.5457&r2=2.5458
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa.c.diff?cvsroot=gcc&r1=2.36&r2=2.37
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-tailcall.c.diff?cvsroot=gcc&r1=2.26&r2=2.27



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468

[Bug tree-optimization/17468] [4.0 regression] Java garbage collector miscompiled at -O1 and higher

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-09-15 08:27 -------
Fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17468